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1 Introduction 



This paper is the second in a series on the relation between algebraic set theory 
[19j and predicative formal systems. The purpose of the present paper is to 
show how realizability models of constructive set theories fit into the framework 
of algebraic set theory. It can be read independently from the first part [5]; 
however, we recommend that readers of this paper read the introduction to [5], 
where the general methods and goals of algebraic set theory are explained in 
more detail. 

To motivate our methods, let us recall the construction of Hyland's effective 
topos £ff [17]. The objects of this category are pairs (X, =), where = is a subset 
of N X X X X satisfying certain conditions. If we write n Ih a; = y in case the 
triple {n,x,y) belongs to this subset, then these conditions can be formulated 
by requiring the existence of natural numbers s and t such that 

s \\- X — x' ^ x' — X 

t\h X = x' Ax' = x" ^ X = x". 

These conditions have to be read in the way usual in realizability [33] . So the first 
says that for any natural number n satisfying n \^ x ^ x' , the expression s{n) 
should be defined and be such that s(n) Ih x' = x. And the second stipulates 
that for any pair of natural numbers n and m with n\\-x = x' and m II- x' = x", 
the expression t{{n,m)) is defined and is such that t{{n,m)) Ih x = x" . 



^For any two natural numbers n, m, the Kleene application of n to in will be written n{m), 
even when it is undefined. When it is defined, this will be indicated by n(m) |. We also 
assume that some recursive pairing operation has been fixed, with the associated projections 
being recursive. The pairing of two natural numbers n and m will be denoted by (n,m). 
Every natural number n will code a pair, with its first and second projection denoted by no 
and ni, respectively. 
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The arrows [F] between two such objects {X, =) and {Y, =) are equivalence 
classes of subsets F oiNx X xY satisfying certain conditions. Writing n Ih Fxy 
for (n, X, y) £ F, one requires the existence of realizers for statements of the form 



Two such subsets F and G represent the same arrow [F] = [G] iff they are 
extensionally equal in the sense that 



is realized. 

As shown by Hyland, the logical properties of this topos £ff are quite re- 
markable. Its first-order arithmetic coincides with the realizability interpreta- 
tion of Kleene (1945). The interpretation of the higher types in Sff is given 
by HEO, the hereditary effective operations. Its higher-order arithmetic is 
captured by realizability in the manner of Kreisel and Troelstra [33j , so as to 
validate the uniformity principle: 



The topos Sff is one in an entire family of "realizability toposes" defined 
over arbitrary partial combinatory algebras (or more general structures mod- 
eling computation). The relation between these toposes has been not been 
completely clarified, although much interesting work has already been done in 
this direction [29l [H HI [1 [15l [M] (for an overview, see [26]). The construction 
of the topos Eff and its variants can be internalised in an arbitrary topos. This 
means in particular that one can construct toposes by iterating (alternating) 
constructions of sheaf and realizability toposes to obtain interesting models for 
higher-order intuitionistic arithmetic HHA. An example of this phenomenon is 
the modified realizability topos, which occurs as a closed subtopos of a realiz- 
ability topos constructed inside a presheaf topos [28] . 

The purpose of this series of papers is to show that these results are not 
only valid for toposes as models of HHA, but also for certain types of cate- 
gories equipped with a class of small maps suitable for constructing models of 
constructive set theories like IZF and CZF. In the first paper of this series 
[5], we have axiomatised this type of categories, and refer to them as "predica- 
tive category with small maps" (for the convenience of the reader their precise 
definition is recalled in Appendix B). A basic result from [5] is the following: 

Theorem 1.1 Every predicative category with small maps {£,S) contains a 
model (y, e) of set theory. Moreover, 



Fxy A X = x' Ay 
Fxy X = X Ay 
Fxy A Fxy' y - 
X = X ^ 3y Fxy. 



y' Fx'y' 

y 



Fxy ^ Gxy 



WX eVNBne n(j){X,n) 3n G NVX e PN(j){X,n). 
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(i) (V, e) is a model ofTZF, whenever the class S satisfies the axioms (M) 
and (PS). 

(a) {V,e) is a model o/CZF, whenever the class S satisfies (F)i 

To show that reaUzabiUty models fit into this picture, we prove that predica- 
tive categories with small maps are closed under internal realizability, in the 
same way that toposes are. More precisely, relative to a given predicative cate- 
gory with small maps , S), we construct a "predicative realizability category" 
(Sffg, Ss). The main result of this paper will then be: 

Theorem 1.2 // (f,iS) is a predicative category with small maps, then so is 
{Sffg^Ss). Moreover, if{£,S) satisfies (M), (F) or (PS), then so does {£ff£,Se) 

We show this for the pea N together with Kleene application, but the result is 
also valid, when this is replaced by an arbitrary small pea A in £. The proof 
of the theorem above is technically rather involved, in particular in the case of 
the additional properties needed to ensure that the model of set theory satisfies 
the precise axioms of IZF and CZF. However, once this work is out of the way, 
one can apply the construction to many different predicative categories with 
small maps, and show that familiar realizability models of set theory (and some 
unfamiliar ones) appear in this way. 

One of the most basic examples is that where £ is the category of sets, and 
S is the class of maps between sets whose fibers are all bounded in size by some 
inaccessible cardinal. The construction underlying Theorem II . 2 1 then produces 
Hyland's effective topos £ff, together with the class of small maps defined in 
|19j . which in [21] was shown to lead to the Friedman-McCarty model of IZF 
[IHIMj (we will reprove this in Section 5). 

An important point we wish to emphasise is that one can prove all the 
model's salient properties without constructing it explicitly, using its universal 
properties instead. We explain this point in more detail. A predicative category 
with small maps consists of a category £ and a class of maps 5 in it, the intuition 
being that the objects and morphisms of £ are classes and class morphisms, and 
the morphisms in S are those that have small (i.e., set-sized) fibres. For such 
predicative categories with small maps, one can prove that the small subobjects 
functor is representable. This means that there is a power class object VsiX) 

which classifies the small subobjects of X, in the sense that maps B >Vs{X) 

correspond bijectively to jointly monic diagrams 

Bi U >X 

with U >B small. Under this correspondence, the identity id: Vs{X) >Ps{X) 

corresponds to a membership relation 

ex > > X X PsX. 

^The precise formulations of the axioms (M), (PS) and (F) can be found in Appendix B 
as well. 
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The model of set theory V that every predicative category with small maps 
contains (Theorem II .![) is constructed as the initial algebra for the "Pg-functor. 
Set-theoretic membership is interpreted by a subobject e C V x V , which one 
obtains as follows. By Lambek's Lemma, the structure map for this initial 
algebra V is an isomorphism. We denote it by Int, and its inverse by Ext: 

Int 
Ext 

The membership relation 

e) >V X V 

is the result of pulling back the usual "external" membership relation 

^v) >V -K Vs{V) 

along id X Ext. 

Theorem 11.11 partlv owes its applicability to the fact that the theory of the 
internal model (V, e) of IZF or CZF corresponds precisely to what is true in 
the categorical logic of S for the object V and its external membership rela- 
tion G. This, in turn, corresponds to a large extent to what is true in the 
categorical logic of £ for the higher arithmetic types. Indeed, by the isomor- 
phism Ext: V vVsiy) and its inverse Int, any generalised element a:X >V 

corresponds to a subobject 

Ext(a) ) > X xV 

with Ext(a) >X small, and for two such elements a and &, one has that 

(i) a G 6 iff a factors through Ext(6). 

(ii) a C 6 iff the subobject Ext(a) of X x y is contained in Ext(6). 

(iii) Ext(ti)) = N, the natural numbers object of £. 

(iv) Ext(a'') = Ext(a)E^'(''). 

(v) Ext(7'a) -Ps(Ext(a)). 

(Properties (i) and (ii) hold by definition; for (iii)-(v), see the proof of Proposi- 
tion 7.2 in 5 .) Thus, for example, the sentence "the set of all functions from 
w to w is subcountable" is true in (V, e) iff the corresponding statement is true 
for the natural numbers object N in the category £. 

For this reason the realizability model in the effective topos inherits various 
principles from the ambient category and one immediately concludes: 
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Corollary 1.3 IZF is consistent with the conjunction of the following axioms: 
the Axiom of Countable Choice (AC), the Axiom of Relativised Dependent 
Choice (RDC), the Presentation Axiom (PA), Markov's Principle (MP), 
Church's Thesis (CT), the Uniformity Principle (UP), Unzerlegharkeit (UZ), 
Independce of Premisses for Sets and Numbers (IP), (IPij)EI 

Of course, Corollarv l 1 . 31 has also been proved directly by realizability [T21l24j : 
however, it is a basic example which illustrates the general theme, and on which 
there are many variations. For example, our proof of Theorem 1 1.21 is elementary 
(in the proof-theoretic sense), hence can be used to prove relative consistency 
results. If we take for £ the syntactic category of definable classes in the theory 
CZF, we obtain Rathjen's reahzabihty interpretation of CZF [30 , and deduce: 

Corollary 1.4 [3D] // CZF is consistent, then so is CZF combined with the 
conjunction of the following axioms: the Axiom of Countable Choice (AC), the 
Axiom of Relativised Dependent Choice (RDC), Markov's Principle (MP), 
Church's Thesis (CT), the Uniformity Principle (UP) and Unzerlegharkeit 
(UZ). 

(We also recover the same result for IZF within our framework.) 

Another possibility is to mix Theorem 11.21 with the similar construction for 
sheaves [5]. This shows that models of set theory (IZF or CZF) also exist for 
various other notions of realizability, such as modified realizability in the sense 
of [2H1 in] or Kleene-Vesley's function realizability We will discuss this in 
some more detail in Section 5 below. 

Inside Hyland's effective topos, or more generally in categories of the form 
Effg (cf. Theorem ll.2[) . other classes of small maps exist, which are not obtained 
from an earlier class of small maps in £ by Theorem ll.21 but nonetheless satisfy 
the conditions sufficient to apply our theorem from [S] yielding models of set 
theory (cf. Theorem 11.11 above) . Following the work of the first author in [1], we 
will present in some detail one particular case of this phenomenon, based on the 
notion of modest set [HI [18] . Already in [19] a class T inside the effective topos 
was considered, consisting of those maps which have subcountable fibres (in 
some suitable sense) . This class does not satisfy the axioms from [19J necessary 
to provide a model for IZF. However, it was shown in [3] that this class T does 
satisfy a set of axioms sufficient to provide a model of the predicative set theory 
CZF. 

Theorem 1.5 [HI [4] The effective topos £ff and its class of subcountable mor- 
phisms T form a predicative category with small maps. Moreover, T satisfies 
the axioms (M) and (F). 

precise formulation of these principles can be found in Appendix A. 
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We will show that the corresponding model of set theory (Theorem ll.ip fits into 
the general framework of this series of papers, and investigate some of its logical 
properties, as well as its relation to some earlier models of Friedman, Streicher 
and Lubarsky [T31 [311 125] ■ In particular, we prove: 

Corollary 1.6 CZF is consistent with the conjunction of the following axioms: 
Full separation, the subcountability of all sets, as well as (AC), (RDC), (PA), 
(MP), (CT), (UP), (UZ), (IP) and (IP„). 

Acknowledgements: We would like to thank Thomas Streicher and Jaap van 
Oosten for comments on an earlier version of this paper, and for making |26| 
available to us. 



2 The category of assemblies 

Recall that our main aim (Theorem II. 2p is to construct for a predicative cate- 
gory with small maps {£, S) the realizability category (Sffg, iSg), and show it is 
again a predicative category with small maps. For this and other purposes, the 
description of £ff as an exact (ex/reg) completion of a category of assemblies 
[llj . rather than Hyland's original description, is useful. A similar remark ap- 
plies to the effective topos £ff[A] defined by an arbitrary small pea A. In [S] we 
showed that the class of predicative categories with small maps is closed under 
exact completion. More precisely, we formulated a weaker version of the axioms 
(a "category with display maps" ; the notion is also recapitulated in Appendix 
B), and showed that if { J-, T) is a pair satisfying the weaker axioms, then in the 
exact completion J- of J- , there is a natural class of arrows T, depending on T, 
such that the pair {T , T) is a predicative category with small maps. Therefore 
our strategy in this section will be to construct a category of assemblies relative 
to the pair [£, S) and show it is a category with display maps (strictly speaking, 
we only need to assume that {£,S) is itself a category with display maps for 
this). Its exact completion will then be considered in the next section. 

In this section, [£, S) is assumed to be a predicative category with small 
maps. 

Definition 2.1 An assembly (over E) is a pair {A, a) consisting of an object A 
in 8 together with a relation a C N x A, which is surjective: 

Va e A3ne N (n, a) e a. 

The natural numbers n such that (n, a) G a are called the realizers of a, and 
we will frequently write n G a{a) instead of {n, a) G a. 

A morphism /: B > A in f is a morphisni of assemblies (i3, /?) {A, a) if 

the statement 
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"There is a natural number r such that for all b and n € /3(6), the 
expression r(n) is defined and r{n) G /3(/6)." 



is valid in the internal logic of £ (note that this makes sense, as the internal logic 
of £" is a version of HA, and therefore strong enough to do all basic recursion 
theory). A number r witnessing the above statement is said to track (or realize) 
the morphism /. The resulting category will be denoted by Asms, or simply 
Asm. 

We investigate the structure of the category Asms- 

Asms has finite limits. The terminal object is (1,??), where 1 = {*} is a 
one-point set and n € r}{*) for every n. The puUback (P, tt) of / and g as in 

(P,7r) >{B,p) 

f 

iC,j)^{A,a) 

can be obtained by putting P — B Xa C and 

n e 7r(6, c) no e (3{b) and ni € 7(c). 

Covers in Asms- A morphism /: {B,0) >{A,a) is a cover if, and only if, 

the statement 

"There is a natural number s such that for all a e ^4 and n e a{a) 
there exists a.b E B with f{b) = a and such that the expression s{n) 
is defined and s{n) € /3(&)." 

holds in the internal logic of £. Prom this it follows that covers are stable under 
pullback in Asm. 

Asms has images. A morphism /: {B, (3) > {A, a) is monic in Asm if, and 

only if, the underlying morphism f:B >A is monic in £. (This means that 

if (i?, p) is a subobject of [A, a), then R is also a subobject of A.) Hence the 
image (7, l) of a map /: {B, fi) >{A, a) as in 

{B,p) ^- >{A,a) 




(AO 

can be obtained by letting / C A be the image of / in £, and 
n e i{a) 36 G Bp{b) = a and n G /3(6). 
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One could also write: i{a) = U6ep-i(a) Pi^)- We conclude that Asm is regular. 
Asms is Heyting. For any diagram of the form 

{S,a) 

{B,P) J >{A,a) 

we need to compute {R, p) = V/(S', cr). We first put Ro = V/S' C A, and let 

p C N X i?o be defined by 

n e p{a) no e a{a) and V6 e f~^{a),m e P{b) (ni(m) J, and ni(m) e a{b) ). 
If we now put 

R= {a G Rq : 3nn E p{a)} 

and restrict p accordingly, the subobject {R, p) will be the result of universal 
quantifying {S, a) along /. 

Asms is positive. The sum {A, a) + {B, /?) is simply {S, a) with S = A + B 
and 

n G a{s) <s^ n e a(s) if s £ A, and n € /3(s) if s G B. 
We have proved: 

Proposition 2.2 T/ie category Asms of assemblies relative to £ is a positive 
Heyting category. 

The next step is to define the display maps in the category of assemblies. 
The idea is that a displayed assembly is an object (B, 0) in which both B and 
the subobject /? C N x i? are small. When one tries to define a family of such 
displayed objects indexed by an assembly {A, a) in which neither A nor a needs 
to be small, one arrives at the concept of a standard display map. To formulate 
it, we need a piece of notation. 

Definition 2.3 Let {B, (5) and {A, a) be assemblies and /: B >A be an arbi- 
trary map in £. We construct a new assembly {B, /?[/]) by putting 

n G I3[f]{b) <^ no e /3(6) and m G a{fx). 

Remark 2.4 Note that we obtain a morphism of assemblies of the form {B, /?[/]) — >■ 
{A, a), which, by abuse of notation, we will also denote by /. Moreover, if / 
was already a morphism of assemblies it can now be decomposed as 

(i?,/3)^(S,/3[/])^(A,a). 
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Definition 2.5 A morphism of assemblies of the form (_B, /?[/]) {A, a) will 
be called a standard display map, if both / and the mono P CNxB are small in 
£ (the latter is equivalent to (3 ^ B being small, or (3{b) being a small subobject 
of N for every b £ B). A display map is a morphism of the form 

W V — ^ U, 

where / is a standard display map. We will write T>£ for the class of display 
maps in Asms- 

Lemma 2.6 1. Let f:{B,(3[f]) }-{A,a) be a standard display map, and 

g: (C, 7) >{A,a) be an arbitrary morphism of assemblies. Then there is 

a pullback square 

{P,n[k])^{B,P[f]) 
k f 
(C,7)^^(A,a) 
in which k is again a standard display map. 
2. The composite of two standard display maps is a display map. 

Proof. (1) We set P = B xaC (as usual), and 

n e 7r(6, c) ^ n e /3(6), 
turning k into a standard display map. Moreover, this implies 

n G 7r[A:](6, c) <^ no G (3{b) and ni G 7(c), 
which is precisely the usual definition. 

(2) Let (C, 7) , (S, j3) and [A, a) be assembhes in which 7 C N x C and /? C N x S 

are small monos, and g:C >B and f:B ¥A be display maps in £. These 

data determine a composablc pair of standard display maps /: {B, /3[/]) >{A, a) 

and g: (C,7[g]) ^(B, /?[/]), in which 

'n'&l[g\{c) ^ no G 7(c) and ni G /3[/](5c) 

-s^ no G 7(c) and (ni)o S (3{gc) and (ni)i G j{fgc). 

So its composite can be written as 

iC 7[5]) {C, S[fg]) {A, a), 

where we have defined 5 C N x C by 

n G 6{c) <^ no G 7(c) and ni G P{gc). 

□ 



9 



Corollary 2.7 Display maps are stable under pullback and closed under com- 
position. 

Proof. Stability of display maps under pullback follows immediately from item 
1 in the previous lemma. To show that they arc also closed under composition, 
we observe first that a morphism / which can be written as a composite 

W V u, 

where h is a standard display map and g is an isomorphism, is a display map. 
For it follows from the previous lemma that there exists a pullback square 

Q—^w 

1 h 

g 

in which g is a standard display map. Therefore / = qp~^ is a display map. 
Now the result follows from the lemma above. □ 



Proposition 2.8 The class of display maps in the category Asmg of assemMies 
as defined above satisfies the axioms (Al), (A3-5), (A7-9). and (AlO) for a 
class of display maps, as well as (NE) and (NS) (see Appendix B). 

Proof. (Al) We have proved pullback stability in the corollary above. 

(A3) It is easy to see that the sum of two standard display maps can be chosen 
to be a standard display map again. From this (A3) follows. 

(A4) It is also easy to see that the maps ^1, 1 ^1 and 1 + 1 >1 are 

standard display maps. 

(A5) Closure of display maps under composition we showed in the corollary 
above. 

(A7) We postpone the proof of the fact that the display maps satisfy the col- 
lection axiom: one will be given in a lemma below. 

(A8) We start with a diagram of the form 

{S,a[i\) 

i 

(B,/3[/]) J >{A,a), 
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in which both maps are standard display maps (this is sufficient to establish the 
general case). We compute (i?, p) = V/(S', cr): first we put Rq = V/S" C A, and 
let p C N X i?o be defined by 

n € p{a) <^ no ^ a(a) and 

V5 G f~'^{a),m e /3[/](6) (ni(m) j and ni{m) G a[i]{b)). 

Furthermore, we set 

R = {a E Rq: 3nn £ p{a)} 

and denote by j the inclusion R C A. By restricting p, the subobject {R, p) will 
be the result of the universal quantifying [S, cr) along /. In the particular case 
we are in, this can be done differently. 

We define r C N x i?o by 

n G T(a) Va G f^^{a),m G (3{b) {ni{m) | and ni(m) G cr(6) ). 

Note that we have a bounded formula on the right (using that N is small). Now 
one can show that 

i? = {a G i?o • 3nn G T(a)}, 

from which it follows that j is a display map (again using that N is small). 
Furthermore, one can prove that the identity is an isomorphism of assemblies 

{R,p)^{R,t[j]), 

from which it follows that (i?, p) — > (A, a) is a display map. 

(A9) The product of an assembly (X, x) with itself can be computed by taking 
(X X X, X X x), where 

e (x X x){x, y) ^no e xi^) and ni G xiv)- 

This means that by writing A:X >X x X for the diagonal map in £, the 

diagonal map in assemblies can be decomposed as follows 

(X, x) [X, p[A]) {X, x) X {X, x), 

where p Cf^ x X is the relation defined by 

n G p{x) Always. 

(AlO) We need to show that for a display map /, if / = me with m a mono 
and e a cover, then also m is display. Without loss of generality, we may assume 

that / is a standard display map /: /?[/]) >{A,a). From Proposition 12.21 

we know that we can compute its image (/, l) by putting / = Im(/) and 

n G t(a) ^3b e f^^{a) n G f3{b). 
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As the formula on the right is bounded, the map m:{I,i) >{A,a) can be 

decomposed as an isomorphism followed by a standard display map: 

(NE) and (NS) The nno in assemblies is the pair consisting of N together with 
the diagonal A C N x N. □ 



We will use the proof that the display maps in assemblies satisfy collection 
to illustrate a technique that does not really save an enormous amount of labour 
in this particular case, but will be very useful in more complicated situations. 

Definition 2.9 An assembly (A, a) will be called partitioned, if 

n e a{a), m G a{a) =^ n ~ m. 
From this it follows that a can be considered as a niorphism A ^ N. 

Lemma 2.10 1. Every assembly is covered by a partitioned assembly. Hence 
every morphism between assemblies is covered by a morphism between par- 
titioned assemblies. 

2. A morphism f: {B,f3) >{A,a) between partitioned assemblies is display 

iff f is small in £. 

3. Every display map between assemblies is covered by a display map between 
partitioned assemblies. 

The definitions of the notions of a covering square and the covering relation 
between maps from [5] are recalled in Appendix B. 

Proof. (1) If {A, a) is an assembly, a can be considered as a partitioned assem- 
bly with n realizing an element (m, a) G a iff n = to. This partitioned assembly 
covers {A, a). 

(2) By definition it is the case that every display map between partitioned 
assemblies has an underlying map which is small. Conversely, if {B,(3) is a 
partitioned assembly, the set is a singleton, and therefore small. So the 
decomposition 

{B,P)^{B,P[f])^{A,a). 
shows that / is a display map, if the underlying morphism is small. 

(3) If /: (B, /3[/]) > (A, a) is a standard display map between assemblies, then 

/?[/] >(S,/3[/]) 

/ / 
a >■ {A, a) 
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is a covering square with a display map between partitioned assemblies on the 
left. □ 



Lemma 2.11 The class of display maps in the category Asms of assemblies 
satisfies the collection axiom (A7). 

Proof. In view of the lemma above, the general case follows by considering 

a display map /: {B,(3) >{A,a) between partitioned assemblies and a cover 

q: {E, 1]) > {B, (3). The fact that g is a cover means that there exists a natural 

number t such that 



(1) 



"For all b E B, the expression t{/3b) is defined, and 
there exists an e G E with q{e) — b and t{(3b) G '7(e)." 

We will collect all those natural numbers in an object 

T — {t: t is a natural number with the property defined above}, 

which can be turned into a partitioned assembly by putting 6{t) — t. From ([1]) 
it follows that T is an inhabited set, and that for 

E' - {(e, b, t) : q{e) = 6, t{pb) j, t{pb) G i^{e)], 

the projection p: E' ^B x T will be a cover. So we can apply collection in £ 

to obtain a covering square 



D- 



-»B xT 

fxT 

-^AxT, 



where g is a small map. It is not so hard to see that from this diagram in £, we 
obtain two covering squares in the category of assemblies 



{D,5) 

9 



ph 



^{B xT,p xt) 

fxT 



^{B,(3) 
f 



(C, 7) — — » (A X T, a X r) » {A, a), 



where we have set 



7(c) — (ax T){kc) and 
5{d) = {l3xT){phd). 
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Since g is a display map between partitioned assemblies, we only need to verify 
that the map {D,5) — > {B, (3) along the top of the above diagram factors as 

We set I = TTih, because one can show that this morphism is tracked, as follows. 
If h{d) — (e, t, b) for some d G D, then the realizer of d consists of a code n for 
the partial recursive function t, together with the realizer pb of b. By definition 
of E', the expression n(/36) is defined and a realizer for e — {TTih){d) —l{d). □ 



3 The predicative realizability category 

Let us recall from [TD] the construction of the (ordinary) exact completion 
^ex/reg of a Hcytiug Category Objects of Tex/reg are the equivalence re- 
lations in which we will denote by X/R when i? C X x X is an equivalence 
relation. Morphisms from X/R to Y/S aie functional relations, i.e., subobjects 
F X xY satisfying the following statements in the internal logic of J-: 

\/x 3yF{x,y), 

xRx' AySy' AFix,y)~^Fix',y'), 
Fix,y)AFix,y')^ySy'. 

There is a functor y-T >J-ex/reg sending an object X to X/Ax, where Ax 

is the diagonal X ^ X x X . This functor is a full embedding preserving the 
structure of a Heyting category. When T is a class of display maps in T, one 
can identify the following class of maps in .?\;x/rcg' 

g G T .9 is covered by a morphism of the form y/ with f £ T. 

We refer to the pair {!F, T) , consisting of the full subcategory T of Tex/reg 

containing those equivalence relations i: R >X x X for which i belongs to T, 

together with T, as the exact completion of the pair [T, T). In |5j we proved 
the following result for such exact completions: 

Theorem 3.1 [5] // {J-,T) is a category with a representable class of display 
maps satisfying (HE), (WE) and (NS), then its exact completion {J-,T) is a 
predicative category with small maps. 

In the rest of the section, we let (f , S) be a predicative category with small 
maps. For such a category we have constructed and studied the pair [Asms^Vg) 
consisting of the category of assemblies and its display maps. We now define 
(Sffg^Ss) as the exact completion of (Asms^Tyg) and prove our main theorem 
fTheorem ll.2l) as an application of Theorem 13. II Much of the work has already 
been done in Section 2. In fact. Proposition 12 . 81 shows that the only thing that 
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remains to be shown are the representabiUty and the vaUdity of axioms (HE) 
and (WE) (see Appendix B). 



Proposition 3.2 The class of display maps in the category Asms of assemblies 
is representable. 

Proof. Let tt: E >U be the representation for the small maps in £. We define 

two partitioned assemblies (T, r) and (-D, 5) by 

T - {(liG [/,p:£;„ — >n)}, 
t{u,p) = 0, 

D = {{ueU,p:Eu >N,eeEu)}, 

S{u,p,e) — pe. 

Clearly, the projection p: {D,S) >(T,t) is a display map, which we will now 

show is a representation. 

Assume /: (-B, (3) > (A, a) is a display map between partitioned assemblies (in 

view of Lemma r2.10l it is sufficient to consider this case). Since / is also a display 
map in £ we find a diagram of the form 




where the left square is covering and the right one a puUback. This induces a 
similar picture 



(Aa)^^— (M,/x)^^(r,r) 

h g 

in the category of assemblies, where we have set: 

g'{m) = {gm,f3lk~^:Eg,n >N), 

film) — ah{'m), so h is tracked and a cover, 

fc'(n) — {g's{n),kn), 

v{n) — {fj,sn,Sk'n), so the righthand square is a puUback. 

Here g' is well-defined, because is a puUback and therefore the map k induces 
for every m G Af an isomorphism 



-^Ea 
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It remains to sec that I is tracked, and the that left hand square is a quasi- 
puUback. For this, one unwinds the definition of u: 

z^(n) = (/isn, Sk'n) 

= {/isn, S{g' s{n), kn)) 
= {iJ,sn,S{gs{n),f3lk~^,kn)) 
= {iJ,sn, pik~^kn) 
= {fisn, (3ln). 

Prom this description of u, we see that I is indeed tracked (by the projection 
on the second coordinate). To sec that the square is a quasi-pullback, one uses 
first of all that it is a quasi-pullback in £, and secondly that the realizers for an 
element in N are the same as that of its image in the pullback (M /x x /?) 

along the canonical map to this object. □ 



Proposition 3.3 The display maps in the category Asms of assemblies are 
exponentiable, i.e., satisfy the axiom (HE). Moreover, i/ (IIS) holds in£, then 
the it holds for the display maps in Asms as well. 

Proof. Let /: (B, /?[/]) > {A, a) be a standard display map and g: (C, 7) > [A, a) 

an arbitrary map with the same codomain. For showing the validity of (HE) it 
suffices to prove that the exponential g^ exists in the slice over {A, a). 

Since / is small, one can form the exponential g^ in £/A, whose typical elements 
are pairs (a € A, (p: Ba ^Ca). If we set 

n G r]{a, (j)) no € a{a) and (V6 G Ba,m G (3{b)) [ni(m) | and ni(m) G 7(^!'&)], 

E = {{a,cP)ef^:{3nGN)[n€v{a,m, 

the assembly {E, rj) with the obvious projection p to {A, a) is the exponential g^ 
in assemblies. This shows validity of (HE) for the display maps in assemblies. 

If g: (C, 7[g]) 7-{A,a) is another standard display map, the exponential can 

also be constructed by putting 

nGf]{a,(j)) ^ {Vb e Ba,m e f3{b))[ni{m) I and ni(m) e 7((/>6)], 
E = {{a,^)€f':i3nen)[n€fiia,<f>)]}. 

It is not hard to see that E = E, and the identity induces an isomorphism of 
assemblies {E,fj[p]) = {E,r]). This shows the stability of (nS). □ 



Proposition 3.4 The display maps in the category Asms of assemblies satisfy 
the axiom (WE). Moroever, if (WS) holds in £, then it holds for the display 
maps in Asms as well. 
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Proof. Let f:{B,P[f]) >{A,a) be a standard display map. Since (WE) 

holds m£, we can form Wf in £. On it, we wish to define the relation (5 C N x Wf 
given by 

n e (5(sup„(i)) ^ no e a{a) and (V& G f^^{a),m G , , 

[ni(m) I and ni(m) G S{tb)] 

(we will sometimes call the elements n G (5(w) the decorations of the tree w G 
TV). It is not so obvious that we can, but for that purpose we introduce the 
notion of an attempt. An attempt is an element a of 7^s(N x Wf) such that 

{n,supg^{t)) G cr => no a{a) and 

(V5 G f^^{a),m G ^9(6)) [ni(m) | and (ni(m),ife) G a]. 

If we now put 

n G (5(w) there exists a decoration cr with (n, lu) G (t, 

the relation S will have the desired property. (One direction in ^ is trivial, 
the other is more involved and uses the collection axiom.) The W-type in the 
category of assemblies is now given by {W^ S) where 

W = {w eWf. (3ne N) [n G 6{w)]}. 

This shows the vailidity of (WE) for the display maps. 

If A is small and (WS) holds in £, then Wf is small. Moreover, if a C N x A 
is small, one can use the initiality of Wf to define a map d: Wf ^Vs^ by 

d(supjj(t)) = {n G N: no G a{a) and 

(V6G/-Ha),mG/3(6))[ni(m) j and ni(m) e d{tb)]}. 

Clearly, n G S{w) iff n G d{w), so (S is a small subobject of N x Wf. This shows 
that {W, S) is displayed, and the stability of (WS) is proved. □ 

To summarise, we have proved the first half of Theorem ll.21 which we phrase 
explicitly as: 

Corollary 3.5 // {£,S) is a predicative category with small maps, then so is 

m£,ss). 

4 Additional axioms 

To complete the proof of Theorem II. 2[ it remains to show the stability of the 
additional axioms (M), (PS) and (F). That is what we will do in this (rather 
technical) section. We assume again that {£, S) is a predicative category with 
small maps. 
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Proposition 4.1 Assume the class of small maps in E satisfies (M). Then 
(M) is valid for the display maps in the category Asmg of assemblies and for 
the small maps in the predicative realizability category Zff ^ as well. 

Proof. Let /: {B,(]) >{A,a) be a monomorphism in the category of assem- 
blies. Then the underlying map / in f is a monomorphism as well. Therefore 
it is small, as is the inclusion (3 CN x B. So the morphism /, which factors as 

(B, P) {B, P[f]) > [A, a), 

is a display map of assemblies. 

Stability of the axiom (M) under exact completion ^ Proposition 6.4] shows 
it holds in Eff^ as well. □ 



Proposition 4.2 Assume the class of small maps in £ satisfies (F). Then (F) 
is valid for the display maps in the category Asms of assemblies and for the 
small maps in the predicative realizability category £ff £ as well. 

Proof. It is sufficient to show the validity of (F) in the category of assemblies, 
for we showed the stability of this axiom under exact completion in [21 Propo- 
sition 6.25]. So we need to find a generic mvs in the category of assemblies for 

any pair of display maps g: {B, (3) > [A, a) and /: {A, a) > (X, x). In view of 

Lemma 6.23 from [S] and Lemma [2.101 above . we may without loss of generality 
assume that g and / are display maps between partitioned assemblies. 

We apply Fullness in £ to obtain a diagram of the form 

P> XxB >B 




where P is a generic displayed mvs for g. This allows us to obtain a similar 
diagram of partitioned assemblies 



{P, n) > > (Y XX B, V X [}) 




^{B,(3) 
a 

^iA,a) 
f 



>(x',x')^^(^,x), 
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where we have set 

X'{x') = xM ior x' ^ X' , 

Y = {(y, n) G y X N : n reaHzes the statement that Py — * Agsy is a cover} 

= {{y, n) e y X N : (Va e Agsy)i3b G B,) [(y, fe) e F and n(a(a)) - 

^'(y,") = {sqy,n) for £ F, 

= {(y, n, &) e r X N X B : (y, n) e f, (y, 6) G P}, 
7r(2/, n, h) = (n, for (y, n, 6) G P. 

The reader should verify that: 

1. g is tracked and a cover. 

2. s is tracked and display, since Y is defined using a bounded formula. 

3. The inclusion {P, n) C (Y xx B,v x (3) is tracked. 

4. It follows from the definition of Y that the map {P, tt) (Y x x A, v x a) 
is a cover. 

We will now prove that (P, tt) is the generic mvs for g in assemblies. 
Let R be an mvs of g over Z, as in: 

(P, p) (Z XX P, C X /3) > (P, /3) 

g 

{Z xx A, C X a) > {A, a) 

f 

{z, c) 1 — > {X', x') {X, x)- 

Since every object is covered by a partitioned assembly (see Lemma [2.10^ . we 
may assume (without loss of generality) that {Z, C) is a partitioned assembly. 
Now we obtain a commuting square 

(P,p) >(i?,p) 

(z,c)^(^,C), 
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in which we have defined 



Z = {{z, m,n) G Z X : m tracks i and 

n realizes the statement that Aqtz is a cover} 

= {(z,m,n) : (V(z,6) eR,ke p{z,b)) [m{k) = (C x I3){z,b)] 
and (Va G Aqtz){^b e Ba) [{z, b) e R and n{a{a)) G p{z, b)} 
^{z,m,n) = {C,z,m,n) for (z, 171,71) G Z 

^ = {(z, TO, n, 5) G ^ X B: (2;, 6) G i? and n(a(g6)) G 6)} 
p{z, TO, n, 6) = {C{z, Tn, n),p{b)) for (2;, to, n,b) G R 

It is easy to see that all the arrows in this diagram are tracked, and the projection 

{Z, Q — > {Z, is a cover. It is also easy to see that {R, p) is still an mvs of g 
in assemblies. Note also that (i?, p) and {Z, Q axe partitioned assemblies. 

Since the forgetful functor to £ preserves mvss in general, and displayed ones 
between partitioned assemblies, R is also a displayed mvs of g in £. Therefore 
there is a diagram of the form 

Ri rp >P 



in £ with tdk = si. We turn T into a partitioned assembly by putting r(t) = 

C(fct) for all t G T. 

Claim: the map l:T >Y factors through Y ^Y via a map l:T >Y which 

can be tracked. Proof: if k{t) = (z, m, n) and l{t) = y for some t gT, we set 

Kt) = (2/, (won)i), 

where m o n is the code of the partial recursive function obtained by composing 
the functions coded by to with n. We first have to show that this is well-defined, 
i.e., l(t) G Y. Since P is an mvs in £, we can find for any a G Aqsy an clement 
b £ Ba with {y, b) G P. If wo take such a b, it follows from Py ~ Pu C that 
{z,m,n,b) G R, and therefore n{a{aj) G p{z,b). Moreover, it follows from the 
fact that {z,m,,n) G Z, that {m. o n)i{a{a)) = /3{b). This shows that l{t) G Y. 
That Z is tracked is easy to see. 

As a result, we obtain a diagram of the form 

{R, p) < 1*{P, 7f) > (P, tt) 
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Given the definitions of p and fr, one sees that 1*{P, tt) — > (i?, p) is tracked. This 
completes the proof. □ 

When it conies to the axiom (PS) concerning power types, there seems to be 

no reason to believe that it will be inherited by the assemblies. But, fortunately, 
it will be inherited by its exact completion, and for our purposes that is just as 
good. 

Proposition 4.3 Assume the class of small maps in £ satisfies (PS). Then 
(PS) is valid in the realizability category Sffg as well. 

Proof. For the purpose of this proof, we introduce the notion of a weak power 
class object. Recall that the power class object is defined as: 

Definition 4.4 By a D -indexed family of subobjects of C, we mean a subobject 
R C C X D. A D-indexed family of subobjects R C C x D will be called <S- 
displayed (or simply displayed), whenever the composite 

RCCx D >D 

belongs to S. If it exists, the power class object VgX is the classifying object for 
the displayed families of subobjects of X. This means that it comes equipped 
with a displayed -'^-indexed family of subobjects of X, denoted by e^C 
X X VgX (or simply G, whenever X is understood), with the property that for 
any displayed y- indexed family of subobjects of X, RC X xY say, there exists 
a unique map p: Y >'PsX such that the square 

R 



X xY )■ X X VsX 

idxp 

is a pullback. 

If a classifying map p as in the above diagram exists, but is not unique, we call 
the power class object weak. We will denote a weak power class object of X 
by VfX. We will show that the categories of assemblies has weak power class 
objects, which are moreover "small" (i.e., the unique map to the terminal object 
is a display map). This will be sufficient for proving the stability of (PS), as 
we will show in a lemma below that real power objects in the exact completion 
are constructed from the weak ones by taking a quotient. 

Let {X, x) be an assembly. We define an assembly (P, tt) by 

P = {(a e VsX, (j): a >Vs^) : (Va; e a)(3n e N) [n e 4>{x)] and 

(3n e N) (Vx G a, m e (f>{x)) [n{m) G xi.x)]}, 
7r(a, 4i) = {n e N : (Va; G a, m e (l>{x)) [n{m) e x(a;)]}- 
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We claim that this assembly together with the membership relation {E, rj) C 
{X, x) X (P, tt) defined by 

E = {{x <E X,a eVsX,(l):a : (a» G P and a; £ a}, 

ri{x, a, 4>) = {?! G N : rto G 4>{x) and ni G T:(a, 4>)} 

is a weak power object in assemblies. 

For let (S", a) be a (standardly) displayed (y, i;)-indexed family of subobjects 

of {X,x). This means that the underlying morphism f:S >Y is small, and 

a — a[f] for a small relation cr C N x S". Since / is small, we obtain a puUback 
diagram of the form 

S 



X xY )■ X X VsX 

id X s 

in £. We use this to build a similar diagram in the category of assemblies: 

{S,a) >(£;,77) 



(X,x)x(r,i;)^(X,x)x(P,^), 

where we have set 

s{y) = {sy,Xx G sy.a{x,y)). 

One quickly verifies that with s being defined in this way, the square is actually 
a puUback. This shows that (P, tt) is indeed a weak power object. 

If {X, x) is a displayed assembly, so both X and x ^ N x X are small, and (PS) 
holds in £, then P and tt are defined by bounded separation from small objects 
in S. Therefore (P, tt) is a displayed object. In the exact completion, the power 
class object is constructed from this by quotienting this object (see the lemma 
below), and is therefore small. □ 

To complete the proof of the proposition above, we need to show the following 
lemma, which is a variation on a result in 5j. 

Lemma 4.5 Lety: {J-,T) >{!F,T) he the exact completion of a category with 

display maps. When VfX is a weak power object for an T -small object X in J- , 
then the power class object in J- exists; in fact, it can be obtained by quotienting 
yVfX by extensional equality. 

Proof. We will drop occurences of y in the proof. 
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On V^X one can define the equivalence relation 

a ~ /3 <^ (Va; e X)[x € a ^ x G p]. 

As X is assumed to be T-small, the mono ~ C V^X x V^X is small, and 
therefore this equivalence relation has a quotient. We will write this quotient as 
PsX and prove that it is the power class object of X in J^. The elementhood 
relation of VgX is given by 

.T G [a] ^ a; G a, 
which is clearly well-defined. In particular, 

» &x 

X X VfX »■ X X VsX 

is a puUback. 

Let [/ C X X / >I be an T-displayed /-indexed family of subobjects oiX. We 

need to show that there is a unique map p: I yVsX such that (id xp)* &x= U. 

Since U S T, there is a map V >J G T such that the outer rectangle in 

V »U 

f 

X X J >X X / 

is a covering square. Now also /: V >X x J £ T, and by replacing / by its 

image if necessary and rising the axiom (AlO). wc may assume that the top 
square (and hence the entire diagram) is a pullback and / is monic. 

So there is a map a: J >V^X in £ with (id x a)* &x= U, by the "universal" 

property of V^X in £. As 

PJ = Pj' ^ V, = Vf CX^ aij) - a{j') 
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for all j, j' 6 J, the map qa coequalises the kernel pair of p. Therefore there is 
a map p: I >VsX such that pp — qa: 

V » U > ex 

/ 

X X J » X xl ¥ X X VsX 

p p ^ 

J » / — > VsX. 

>■ 

qcr 

The desired equality (id x p)* Gx= U now follows. The uniqueness of this map 
follows from the definition of ~. □ 

The proof of this proposition completes the proof of our main result, Theorem 

5 Realizability models for set theory 

Theorem 11.11 and Theorem 1 1 . 2 1 together imply that for any predicative category 
with small maps {£,S), the category {£ff£,Ss) will contain a model of set 
theory. As already mentioned in the introduction, many known constructions 
of realizability models of intuitionistic (or constructive) set theory can be viewed 
as special cases of this method. In addition, our result also shows that these 
constructions can be performed inside weak metatheories such as CZF, or inside 
other sheaf or realizability models. 

To illustrate this, we will work out one specific example, the realizability 
model for IZF described in McCarty ^4] (we will comment on other examples 
in the remark closing this section). To this end, let us start with the category 
Sets and fix an inaccessible cardinal k> to. The cardinal k can be used to define 
a class of small maps S in Sets by declaring a morphism to be small, when all 
its fibres have cardinality less than k (these will be called the K-small maps). 
Because the axiom (M) then holds both in £ and the category of assemblies, the 
exact completion Asm of the assemblies is really the ordinary exact completion, 
i.e., the effective topos. This means we have defined a class of small maps in 
the effective topos. We will now verify that this is the same class of small maps 
as defined in [T^. 

Lemma 5.1 The following two classes of small maps in the effective topos co- 
incide: 

(i) Those covered by a map f between partitioned assemblies for which the 
underlying map in £ is K-small (as in J19\j). 



24 



(ii) Those covered by a display map f between assemblies (as above). 

Proof. Immediate from Lemma r2.10l and the fact that the covering relation is 
transitive. □ 



By the general existence result, the effective topos contains a model of IZF 
which we will call V. 

Proposition 5.2 In V the following principles hold: (AC), (RDC), (PA), 
(MP), (CT). Moreover, V is uniform, and hence also (UP), (UZ), (IP) and 
(IP^) hold. 

Proof. The Axioms of Countable and Relativised Dependent Choice hold in 
V, because they hold in the effective topos (recall the remarks on the relation 
between truth in V and truth in the surrounding category from the introduction; 
in particular, that Int(N) = w). The same applies to Markov's Principle and 
Church's Thesis (for Church's thesis it is also essential that the model V and 
the effective topos agree on the meaning of the T- and U -predicates) . 

The Presentation Axiom holds, because (internally in £ff) every small object 
is covered by a small partitioned assembly (see the Lemma above), and the 
partitioned assemblies are internally projective in £ff. 

The Uniformity Principle, Unzerlegbarkeit and the Independence of Premisses 
principles are immediate consequences of the fact that V is uniform (of course, 
Unzerlegbarkeit follows immediately the Uniformity Principle; note that for 
showing that the principles of (IP) and (IP^j) hold, we use classical logic in the 
metatheory). 

To show that V is uniform, we recall from [S] that the initial Pg-algebra is 
constructed as a quotient of the W-type associated to a representation. In 
Proposition 13.21 we have seen that the representation p can be chosen to be a 

morphism between (partitioned) assemblies {D, S) > (T, r), where T is uniform 

(every element in T is realized by 0). As the inclusion of Asm in £ff preserves 
W-types, the associated W-type might just as well be computed in the category 
of assemblies. Therefore it is constructed as in Proposition [3l4j for building the 

W-type associated to a map /: (B,(3) >{A,a), one first builds W{f) in Sets, 

and defines (by transfinite induction) the realizers of an element sup^(t) to be 
those natural numbers n coding a pair (ng, ni) such that (i) ng G a(a) and (ii) 
for all b G f~^{a) and m € (3{b), the expression ni(m) is defined and a realizer 
of tb. Using this description, one sees that a solution of the recursion equation 
/ = {0,Xn.f) realizes every tree. Hence W{p), and its quotient V, are uniform 
in £ff. □ 

We will now show that V is in fact McCarty's model for IZF. For this, we 
will follow a strategy different from the one in [21j : we will simply "unwind" 
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the existence proof for V to obtain a concrete description. First, we compute 
W = W{p) in assemblies (see the proof above). Its underlying set consists of 
well-founded trees, with every edge labelled by a natural number. Moreover, at 
every node the set of edges into that node should have cardinality less than k. 
One could also describe it as the initial algebra of the functor X i-^ Vi^{N x X), 
where VniY) is the set of all subsets of Y with cardinality less than k: 



K(N X W) ' W. 

E 

Again, the realizers of a well-founded tree w & W are defined inductively: n is 
a realizer of w, if for every pair {m,v) G E(t«), the expression n{m) is defined 
and a realizer of v. 

The next step is dividing out, internally in f//, by bisimulation: 

w w' <^ (V(m, u) e E(t(;)) (3(to', u') G E(w'))[i> ~ !>'] and vice versa. 

The internal validity of this statement should be translated in terms of realizers. 
To make the expression more succinct one could introduce the "abbreviation" : 

n Ih w'ew <^ {3{m,v) G E(t(;)) [no = m and ni Ih w' ~ v], 

so that it becomes: 

nW-W'^w' ^ (V(m, u) e E(w))[no(m) I and no(m) Ih w et«'] and 
(V(m',u') e E{w')) [ni(m') i and ni(m') Ih v' ew]. 

By appealing to the Recursion Theorem, one can check that we have defined an 
equivalence relation on W{p) in the effective topos (although this is guaranteed 
by the proof of the existence theorem for V). The quotient will be the set- 
theoretic model V. So, its underlying set is W and its equality is given by 
the formula for ~. Of course, when one unwinds the definition of the internal 
membership e C V x V , one obtains precisely the formula above. 

Corollary 5.3 The following clauses recursively define what it means that a 
certain statement is realized by a natural number n in the model V: 

n Ih w'ew (3(m, v) S E(u')) [no = m and ni Ih w' = v]. 

n\\-w = w' {y{m,v) €E{w))[no{m) i and no{m) \\- v e w'] and 

(V(m',t;') G E{w'))[ni{m') I and ni{m') \h v' ew]. 

n\\- (j> Atp <4> no\\-(f> and ni Ih tp. 

n Ih V "0 <^ n — {0, m) and m Ih 0, or n — (1, m) and m Ih tp. 

n\\- 4> ^ ip 4^ For all m Ih </>, we have n ■ m I and n ■ m\\- 4'- 

n II — 10 There is no m such that m Ih (p. 

n Ih 3a; (p{x) n Ih (^(a) for some a G V. 

n Ih Va; (f>{x) <^ n Ih (/)(a) for all a gV. 
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Proof. The internal logic of Sff is realizability, so the statements for the logical 
connectives immediately follow. For the quantifiers one uses the uniformity of 
V. □ 



We conclude that the model is isomorphic to that of McCarty [53^ (based on 
earlier work by Friedman [12] ) . 

Remark 5.4 There are many variations and extensions of the construction 
just given, some of which we already alluded to in the introduction. First of 
all, instead of working with a inaccessible cardinal n, we can also work with the 
category of classes in Godel-Bernays set theory, and call a map small if its fibres 
are sets. (The slight disadvantage of this approach is that one cannot directly 
refer to the effective topos, but has to build up a version of that for classes first.) 

More generally, one can of course start with any predicative category with 
a class of small maps {£,S). If {£,S) satisfies condition (F), then so will 
its realizability extension, and by Theorem 11.11 this will produce models of 
CZF rather than IZF. For example, if we take for {£,S) the syntactic category 
with small maps associated to the the theory CZF, then one obtains Rathjen's 
syntactic version of McCarty's model [3(T. 

Alternatively (or, in addition), one can also replace number realizability by 
realizability for an arbitrary small partial combinatory algebra A internal to £. 
Very basic examples arise in this way, already in the "trivial" case where £ is 
the topos of sheaves on the Sierpinski space, in which case an internal pea A can 
be identified with a suitable map between pea's. The well-known Kleene-Vesley 
realizability [20] is in fact a special case of this construction. More generally, 
one can start with a predicative category with small maps {£, S) and intertwine 
the construction of Theorem II .21 with a similar result for sheaves, announced in 
[5] and discussed in detail in Part III of this series [7]: 

Theorem 5.5 ^ Let {£,S) be a predicative category with small maps satisfying 
(nS), and C a small site with a basis in £. Then the category of sheaves Shgp] 
carries a natural class of maps SglC], such that the pair {Shg [C],S£[C]) is again 
a predicative category with small maps satisfying (HS). Moreover, this latter 
pair satisfies (M), (F) or (PS), respectively, whenever the pair {£,S) does. 

Thus, if C is a small site in £, and ,4 is a sheaf of pea's on C, one obtains a 
predicative category with small maps {£' ,S') = (f//sh£[C][-4]i'5sh£[C][-^])j ^ 
the case of Kleene-Vesley realizability [5] . 

Any open (resp. closed) subtopos defined by a small site in {£' ,S') will now 
define another such pair {£" , S"), and hence a model of IZF or CZF if the con- 
ditions of Theorem 1 1 . 1 1 are met by the original pair (£, S). One might refer to its 
semantics as "relative realizability" (resp. "modified relative realizability" ) . It 
has been shown by [5] that relative realizability [SI [31] and modified realizability 
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[25] are special cases of this, where Sh£[C] is again sheaves on Sierpinski space 
(see also [26]). 

6 A model of CZF in which all sets are sub- 
countable 

In this section we will show that CZF is consistent with the principle saying 
that all sets are subcountable (this was first shown by Streicher in [32]; the 
account that now follows is based on the work of the first author in |3]). For 
this purpose, we consider again the effective topos £ff relative to the classical 
metatheory Sets. We will show it carries another class of small maps. 

Lemma 6.1 The following are equivalent for a morphism f: B ¥A in £ff. 

1. In the internal logic of £ff it is true that all fibres of f are quotients of 
subobjects o/N (i.e., subcountable). 

2. In the internal logic of £ff it is true that all fibres of f are quotients of 
-'-'-closed subobjects ofN. 

3. The morphism f fits into a diagram of the following shape 

X X <Y » B 

X » A 

where the square is covering and Y is a -'^-closed subobject of X x N. 

Proof. Items 2 and 3 express the same thing, once in the internal logic and 
once in diagrammatic language. That 2 implies 1 is trivial. 

1 =^ 2: This is an application of the internal validity in £ff of Shanin's Principle 
[271 Proposition 1.7]: every subobject of N is covered by a ^-i-closed one. For 
let y be a subobject of X x N in £ff /X. Since every object in the effective 
topos is covered by an assembly, we may just as well assume that X is an 
assembly {X,x). The subobject F C X x N can be identified with a function 

Y: X X N >VN for which there exists a natural number r with the property 

that for every m S Y{x,n), the value r(m) is defined and codes a pair (/co,A;i) 
with fco G x{x) s-iid ^1 — 1^- One can then form the assembly (f*, tt) with 

P = { {x,n) Cz X X N : n codes a pair (tiq, ni) with ni G Y{x, uq) }, 
Tr(x, n) = {(fco, fci) : fco G x{^) = '^li 
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which is actually a -i-i-closed subobject of X x N. P covers Y, clearly. The 
diagram 



P »Z 




X xN 



does not commute, but composing with the projection X x N >X it does. □ 



Let T be the class of maps having any of the equivalent properties in this 
lemma. 

Remark 6.2 The morphisms belonging to T were called "quasi- modest" in [TH] 
and "discrete" in [18]. In the latter the authors prove another characterisation 
of T due to Freyd: the morphisms belonging to T are those fibrewise orthogonal 
to the subobject classifier ft in £ff (Theorem 6.8 in loc.cAt ). 

Proposition 6.3 [19|, Proposition 5.4] The class T is a representable class of 
small maps in £ff satisfying (M) and (NS) . 

Proof. To show that T is a class of small maps, it is convenient to regard 
T as 2?'=°'^ (the class of maps covered by elements of V), where T) consists of 

those maps g:Y >X for which 1^ is a -i-i-closed subobject of X x N. It 

is clear that V satisfies axioms (Al, A3-5) for a class of display maps, and 
(NS) as well (for (A5), one uses that there is an isomorphism N x N = N in 

£ff )- It also satisfies axiom (A7), because all maps g: Y >X in V are choice 

maps, i.e., internally projective as elements of £ff/X. The reason is that in 
Sff the partitioned assemblies are projective, and every object is covered by a 
partitioned assembly. So if X' is some partitioned assembly covering X, then 
also X' X N is a partitioned assembly, since N is a partitioned assembly and 
partitioned assemblies are closed under products. Moreover, Y Xx X' as a. -i-i- 
closed subobject of X' x N is also a partitioned assembly. From this it follows 
that g is internally projective. A representation tt for J) is obtained via the 
pullback 

Gn ) > 

TT 

p_,^(N) ) >P(N). 

Furthermore, it is obvious that all monomorphisms belong to T, since all the 
fibres of a monic map are subcountablc (internally in Sff). 

Now it follows that T is a representable class of small maps satisfying (M) and 
(NS) (along the lines of Proposition 2.14 in [5]). □ 
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Proposition 6.4 [3| The class T satisfies (WS) and (F). 



Proof. (Sketch.) We first observe that for any two morphisms f:Y >X and 

g: Z >X belonging to V, the exponential {f^)x belongs to T. Without 

loss of generality we may assume X is a (partitioned) assembly. If 1^ C X x N 

and Z C X X N are -i^-closed subobjects, then every function h: Yx >Zx over 

some fixed x E X is determined uniquely by its realizer, and so all fibres of 
{f^)x >X are subcountable. 

To show the validity of (F), it suffices to show the existence of a generic T- 

displayed mvss for maps g: B >A in V, with f:A >X also in V (in view 

of Lemmas 2.15 and 6.23 from [5]). Because / is a choice map, one can take 
the object of all sections of g over X, which is subcountable by the preceding 
remark. 

The argument for the validity of (WS) is similar. We use again that every 

composable pair of maps g:B >A and f:A >X belonging to T fit into 

covering squares of the form 



B' 



A' >A 

f 

X' »X, 

with g' and /' belonging to T>. We may also assume that X' is a (partitioned) 
assembly. The W-type associated to g' in Eff / X' is subcountable, because every 
element of W{g')x' in the slice over some fixed x G X' is uniquely determined 
by its realizer. The W-type associated to p*g in the slice over X' is then a 
subquotient of W{g')x' (see the proof of Proposition 6.16 in [5j), and therefore 
also subcountable. Finally, the W-type associated to g in the slice over X is 
also subcountable, by descent for T. □ 



We will obtain a model of CZF and Full separation by considering the initial 
algebra U for the power class functor associated to T, which we will denote by 
Vt. 

Int 
Ext 

In the proposition below, we show that it is not a model of IZF, for it refutes 
the power set axiom. 

Proposition 6.5 The statement that all sets are subcountable is valid in the 
model U . Therefore it refutes the power set axiom. 



30 



Proof. As we explained in the introduction, the statement that all sets are sub- 
countable follows from the fact that, in the internal logic of the effective topos, 
all fibres of maps belonging to T are subcountable. But the principle that all 
sets are subcountable immediately implies the non-existence of Vlo^ using Can- 
tor's Diagonal Argument. And neither does Vl when 1 = {0} is a set consisting 
of only one element. For if it would, so would ('PI)", by Subset Collection. But 
it is not hard to see that (PI)" can be reworked into the powerset of w. □ 

Proposition 6.6 The choice principles (CC), (RDC), PA) are valid in the 
model U . Moreover, as an object of the effective topos, U is uniform, and 
therefore the principles (UP), (UZ), (IP) and (IP^) hold in U as well. 

Proof. The proof is very similar to that of Proposition [521 

The Axioms of Countable and Relativised Dependent Choice U inherits from 
the effective topos £ff. To see that in U every set is the surjective image of a 
projective set, notice that every set is the surjective image of a -i^-closed subset 
of w, and these are internally projective in £ff. 

To show that U is uniform it will suffice to point out that the representation 
can be chosen to be of a morphism of assemblies with uniform codomain. Then 
the argument will proceed as in Proposition [521 In the present case, the repre- 
sentation TT can be chosen to be of the form 

Gat ) > Gn 



V^-.{N) ) >V{N). 

So therefore tt is a morphism between assemblies, where V^^^N) = VPN, i.e. 
the set of all subsets A of the natural numbers, with A being realized by 0, say, 
and £_N= {{n,A) : n G A}, with {n,A) being realized by n. So tt is indeed of 
the desired form, and U will be uniform. Therefore it validates the principles 
(UP), (UZ), (IP) and (IP^). □ 



Remark 6.7 It follows from results in [25] that the Regular Extension Axiom 
from 2J also holds in U. For in ^25], the authors prove that the validity of the 
Regular Extension Axiom in V follows from the axioms (WS) and (AMC) 
for T. (AMC) is the Axiom of Multiple Choice (see [IS]), which holds here 
because every f € T fits into a covering square 

Y »B 

9 f 
X »A, 
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where g: Y >X is a small choice map, hence a small collection map over X . 

The model U has appeared in different forms in the literature, its first ap- 
pearance being in Friedman's paper [13] . We discuss several of its incarnations. 

We have seen above that for any strongly inaccessible cardinal k > uj, the 
effective topos carries another class of small maps S. For this class of small 
maps, the initial Vg-algehia, V is precisely McCarty's realizability model for 
IZF. It is not hard to see that T C S, and therefore there exists a pointwise 
monic natural transformation Vt Vg- This implies that our present model U 
embeds into McCarty's model. 

VtU >VtV 



Int 



VsV 

Int 



Actually, U consists of those x eV that V believes to be hereditarily sub- 
countable (intuitively speaking, because V and £Jf agree on the meaning of the 
word "subcountable" , see the introduction). To see this, write 

A — {x : V \^ X \s hereditarily subcountable}. 

A is a Pt-subalgebra of V , and it will be isomorphic to C/, once one proves that is 
initial. It is obviously a fixed point, so it suffices to show that it is well-founded 
(see [3 Theorem 7.3]). So let i? C A be a Pt-subalgebra of A, and define 

W^{x<eV: xeA^x(^ B}. 

It is not hard to see that this is a P^-subalgebra oiV,s,oW — V and A — B. 

This also shows that principles like Church's Thesis (CT) and Markov's 
Principle (MP) are valid in t/, since they are valid in McCarty's model V . 

One could also unravel the construction of the initial algebra for the power 
class functor from [Sj to obtain an explicit description, as we did in Section 5. 
Combining the explicit description of a representation tt in Proposition IG . 61 with 
the observation that its associated W-type can be computed as in assemblies, 
one obtains the following description oiW = Wt^ in Sff . The underlying set 
consists of well-founded trees where the edges are labelled by natural numbers, 
in such a way that the edges into a fixed node are labelled by distinct natural 
numbers. So a typical element is of the form sup^(t), where A is a subset of N 
and i is a function A W . An alternative would be to regard W as the initial 
algebra for the functor X i-^ [N ^ X], where [N ^ X] is the set of partial 
functions from N to X. The decorations (realizers) of an clement w ^ W are 
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defined inductively: n is a reafizer of sup^(i), if for every a G A, the expression 
n{a) is defined and a realizer of t{a). 

We need to quotient W, internally in Sff, by bisimulation: 

sup^(t) ^ sup^/(i') <^ (Va G A) {3a' G A') [ta ^ t'a'] and vice versa. 

To translate this in terms of realizers, we again use an "abbreviation" : 
n Ih a;esup^(t) 4^ no G A and ni Ih a; ~ t{no). 

Then the equivalence relation r^C W x W is defined by: 

n Ih supyt(i) sup^/(i') <^ (Va G A) [no{a) I and no(a) Ih ta e sup j^i(t')] and 

(Va' G A') [ni(a') i and ni(a') Ih t'a' esup^(t)]. 

The quotient in Sff is precisely U, which is therefore the pair consisting of the 
underlying set of W together with ~ as equality. The reader should verify that 
the internal membership is again given by the "abbreviation" above. 



Corollary 6.8 The following clauses recursively define what it means that a 
certain statement is realized by a natural number n in the model U : 

n Ih a: e sup^(t) <=^ hq £ A and ni Ih a; = t(no)- 

n Ih sup^(t) = sup^/ (t') -i^ (Va G A) [ no(a) I and no(a) Ih ta e sup^, (t')] and 

(Va' G A') [ni(a') j and ni{a') Ih t'a' e sup ^{t)]. 

n Ih A V' no Ih (/) and ni Ih ip. 

n Ih (/) V ^ <^ n — {0, m) and m Ih 0, or n = (1, rn) and m Ih tp. 

n Ih — !■ ^ <^ For all mW- (j),n ■ m I and n ■ rn Ih -0. 

n II — '(f> <^ There is no m such that m Ih 

n Ih Ela; (^{x) <^ n Ih 4>{a) for some a £ U. 

n Ih Va; (j){x) <=^ n Ih (j){a) for all a £ U. 



From this it follows that the model is the elementary equivalent to the one used 
for proof-theoretic purposes by Lubarsky in [53] . 

Remark 6.9 In an unpublished note [32] j Streicher builds a model of CZF 
based an earlier work on rcalizability models for the Calculus of Constructions. 
In our terms, his work can be understood as follows. He starts with the mor- 
phism r in the category Asm of assemblies, whose codomain is the set of all 
modest sets, with a modest set realized by any natural number, and a fibre 
of this map over a modest set being precisely that modest set (note that this 
map again has uniform codomain) . He proceeds to build the W-type associated 
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to T, takes it as a universe of sets, while interpreting equality as bisinmlation. 
One cannot literally quotient by bisimulation, for which one could pass to the 
effective topos. 

When considering r as a morphism in the effective topos, it is not hard to see 
that it is in fact another representation for the class of subcountablc morphisms 
T: for all fibres of the representation tt also occur as fibres of r, and all fibres of 
T are quotients of fibres of tt. Therefore the model is again the initial Pj-algebra 
for the class of subcountable morphisms T in the effective topos. 

A Set-theoretic axioms 

Set theory is a first-order theory with one non-logical binary relation symbol 
e. Since we are concerned with constructive set theories in this paper, the 
underlying logic will be intuitionistic. 

As is customary also in classical set theories like ZF, we will use the abbre- 
viations 3xea (. . .) for 3a; (xea A . . .), and Vccea (. . .) for Vx (ccea . . .). Recall 
that a formula is called hounded, when all the quantifiers it contains are of one 
of these two forms. 

A.l Axioms of IZF 

The axioms of IZF are: 

Extensionality: Vx ( xea xeb) — > a = 6. 

Empty set: 3x\ly -lyex. 

Pairing: 3x Vy ( yex ^ y = a\/ y = b). 

Union: Bx^y {yex ^ 3zeayez). 

Set induction: Vx {\/yex (t){y) (f>{x)) ^ Wx (p{x). 

Infinity: 3a ( 3x xea ) A ( Vxea 3yea xey ) . 

Full separation: 3x \/y ( yex ^ yea A 4>{y) ), for any formula (p in which o does 
not occur. 

Power set: 3x Vy ( yex ^ y C a ) , where y Q a abbreviates {zey zea) . 
Strong collection: \/xea3y (l){x,y) 3bB{xea,yeb) (p. 

In the last axiom, the expression 

B{xea, yeb) cj). 

has been used as an abbreviation for Vxea 3yeb 4> A Myeb 3xea cf). 
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A. 2 Axioms of CZF 

The set theory CZF, introduced by Aczel in , is obtained by replacing Full 
separation by Bounded separation and the Power set axiom by Subset collection: 

Bounded separation: 3x\/y ( ytx ^ yea A ), for any bounded formula 
in which a does not occur. 

Subset collection: ElcVz (Va;ea Byefo 0(a;, y, z) 3dec'Q{xea^yed) (j){x^y, z)). 
A. 3 Constructivist principles 

In this paper we will meet the following constructivist principles associated to 
recursive mathematics and realizability. In writing these down, we have freely 
used the symbol lo for the set of natural numbers, as it is definable in both CZF 
and IZF. We also used for zero and s for the successor operation. 

Axiom of Countable Choice (CC) 

Viecj 3x ip{i, x) ~^ 3a, f: lo >ayieuj il>{i, /(*))■ 

Axiom of Relativised Dependent Choice (RDC) 

0(xo) A 'ix(<i,{x) ^3y{i;{x,y) A (/.(y))) 

3a 3f: u >a (/(O) = .To A G f{si))). 

Presentation Axiom (PA) Every set is the surjective image of a projective 
set (where a set a is projective, if every surjection & — > a has a section). 

Markov's Principle (MP) 

Vnecj [(j){n) V -^(j){n)] —>■ [-'^3n G uj (j){n) 3n€L0 (j){n)\. 

Church's Thesis (CT) 

Vneoj 3meLU 4>{n, m) 3eeuj Vnetu 3to, pecu [T(e, n, p) A U{p, m) A (j}{n, m)] 

for every formula (j)(u,v), where T and U are the set-theoretic predi- 
cates which numeralwise represent, respectively, Kleene's T and result- 
extraction predicate U . 

Uniformity Principle (UP) 

yx3yeuj (j){x,y) 3yeuj\fx (f){x,y). 

Unzerlegbarkeit (UZ) 

Va; {4>{x) V -^4>{x)) — > Vx (/) V Vx 
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Independence of Premisses for Sets (IP) 

where 6 is assumed to be closed. 
Independence of Premisses for Numbers (IP^) 

{-'O 3neu) ij)) — > 3neoj ( — > V)> 
where 6 is assumed to be closed. 



B Predicative categories with small maps 



In the present paper, the ambient category 8 is always assumed to be a positive 
Heyting category. That means that £ is 

(i) cartesian, i.e., it has finite limits. 

(ii) regular, i.e., morphisms factor in a stable fashion as a cover followed by a 
monomorphism. 

(iii) positive, i.e., it has finite sums, which are disjoint and stable. 

(iv) Heyting, i.e., for any morphism f:Y )-X the induced puUback functor 

/*: Suh{X) s-Sub(y) has a right adjoint V/. 

Definition B.l A diagram in £ of the form 

D s-C 



is called a quasi-pullback, when the canonical map D yB C is a cover. If 

p is also a cover, the diagram will be called a covering square. When / and g 
fit into a covering square as shown, we say that / covers g, or that g is covered 
by /. 

A class of maps in £ satisfying the following axioms (Al-9) will be called a 
class of small maps: 

(Al) (PuUback stability) In any puUback square 

D >B 



C- 



where / € <S, also g £ S. 



36 



(A2) (Descent) If in a puUback square as above p is a cover and g £ S, then 

also / e 5. 

(A3) (Sums) Whenever X >Y and X' )■¥' belong to S, so does X + 

X' >Y + Y'. 

(A4) (Finitcness) The maps 1 >-l and 1 + 1 >-l belong to S. 

(A5) (Composition) S is closed under composition. 
(A6) (Quotients) In a commuting triangle 



z »y 




X, 

if / is a cover and h belongs to S, then so does g. 

( A7) (Collection) Any two arrows p: Y ^ X and /: X > A where p is a cover 

and / belongs to <S fit into a covering square 

Z ^Y^-^X 

9 f 

B ^A, 

where g belongs to S. 

(A8) (Heyting) For any morphism /: Y )-X belonging to 5, the right adjoint 

V/:Sub(r) ^Sub(X) 

sends small monos to small monos. 
(A9) (Diagonals) All diagonals Ax:^ >X x X belong to S. 

In case S satisfies all these axioms, the pair (f , S) will be called a category with 
small maps. Axioms (A4,5,8,9) express that the subcategories Sx of E/X 
whose objects and arrows are both given by arrows belonging to the class <S, are 
full subcategories oi£/X which are closed under all the operations of a positive 
Heyting category. Moreover, these categories together should form a stack on 
£ with respect to the finite cover topology according to the Axioms (Al-3). 
Finally, the class <S should satisfy the Quotient axiom (A6) (saying that if a 
composition 

C ^B >A 
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belongs to iS, so does B >A), and the Collection Axiom (A7). This axiom 

states that, conversely, if B >A belongs to S and 

C »B 

is a cover (regular epimorphism) , then locally in A this cover has a small refine- 
ment. 

The following weakening of a class of small maps will play a role as well: a 
class of maps satisfying the axioms (Al), (A3-5), (A7-9), and 

(AlO) (Images) If in a commuting triangle 



Z »Y 




X, 

e is a cover, m is monic, and / belongs to <S, then m also belongs to <S. 

will be a called a class of display maps. 

Whenever a class of small maps (resp. a class of display maps) <S has been 
fixed, an object X will be called small (resp. displayed), whenever the unique 
map from X to the terminal object is small (resp. a display map). 

In this paper, we will see the following additional axioms for a class of small 
(or display) maps. 

(M) All monomorphisms belong to <S. 

(PE) For any object X the power class object VsX exists. 

(PS) Moreover, for any map /: Y >X e <S, the power class object 'P^{f) >X 

in £/X belongs to <S. 

(IIE) All morphisms / S <S are exponentiable. 

(nS) For any map /: Y >X G S, a functor 

Ilf.S/Y^S/X 

right adjoint to puUback exists and preserves morphisms in S. 

(WE) For all /: X >Y e S, the W-type Wf associated to / exists. 

(WS) Moreover, if Y is small, also Wf is small. 

(NE) £ has a natural numbers object N. 

(NS) Moreover, N >1 e S. 
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(F) For any (j): B >A G S over some X with A >X G S, there is a cover 

q: X' >X and a map y.Y >X' belonging to S, together with a dis- 
played mvs P oi (j) over Y , with the following "generic" property: if 

z: Z )-X' is any map and Q any displayed mvs of (j) over then there is 

a map k: U >Y and a cover U >Z with yk = zl, such that k*P < l*Q 

as (displayed) mvss of over U. 

More details are to be found in [5l. 

A category with small maps {£,S) will be called a predicative class with 
small maps, if S satisfies the axioms (HE), (WE), (NS) and in addition: 

(Representability) The class S is representable, in the sense that there is a 

small map n: E >U (a representation) of which any other small map 

/: Y >X is locally (in X) a quotient of a puUback. More explicitly: any 

/: Y >X G S fits into a diagram of the form 

y « B >E 

f 

X « A > U, 

where the left hand square is covering and the right hand square is a 
pullback. 

(Exactness) For any equivalence relation 

R> >X X X 

given by a small mono, a stable quotient X/R exists in £. 
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